Commit 2f78d16db74 for woocommerce
commit 2f78d16db74aa7563bd52806d0feaf5b53e205bc
Author: Ján Mikláš <neosinner@gmail.com>
Date: Fri Aug 21 10:32:15 2026 +0200
Resolve nine Composer security alerts (#67596)
* Update the vendored webonyx/graphql-php to 15.32.3
Resolves GHSA-fc86-6rv6-2jpm (quadratic validation cost in
OverlappingFieldsCanBeMerged) and GHSA-r7cg-qjjm-xhqq (unbounded parser
recursion causing stack exhaustion). This library is Mozart-vendored into
lib/packages and re-namespaced under Automattic\WooCommerce\Vendor, so the
regenerated files are committed alongside the lock.
The fix adds two new limits that apply to the GraphQL API: Parser now
enforces a default recursion limit of 256, and OverlappingFieldsCanBeMerged
stops after 100,000 field comparisons. Both reject inputs that previously
would have been parsed or validated, which is the intent of the advisories.
Pinned to 15.32.3 rather than the latest 15.37.1 to keep the change to the
minimum that clears both advisories.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
* Resolve symfony/process advisories in the extension scaffolds
Both scaffolds pinned automattic/jetpack-changelogger to 3.3.0, which held
symfony/process on the 3.4 branch. Widening to ^3.3.11 moves it to the 5.4
branch, past GHSA-qq5c-677p-737q and GHSA-r39x-jcww-82v6.
Adding prefer-stable is what makes the result concrete: with only
minimum-stability: dev set, Composer resolved every transitive dependency to
a dev branch, so the lock recorded "5.4.x-dev" instead of a real version.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
* Drop PHPUnit from the beta tester and move symfony/process to 5.4
The plugin has no PHP tests and no phpunit.xml, so phpunit/phpunit was a dead
require-dev pinning the vulnerable 7.5 line (GHSA-vvj3-c3rp-c85p). Removed it
along with the composer test script that was its only caller.
symfony/process reaches 5.4.51 (GHSA-qq5c-677p-737q, GHSA-r39x-jcww-82v6) via
jetpack-changelogger ^3.3.11, which needs config.platform.php raised from 7.2
to 7.4. 7.4 is what the plugin header already declares, so the old value was
just stale.
Verified changelogger and phpcs still run from vendor/bin.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
* Add changelog entries for the remaining PHP dependency updates
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
* Disable the graphql-php field-comparison cap in the GraphQL controller
graphql-php 15.32.2 added a 100,000 field-comparison cap to
OverlappingFieldsCanBeMerged as the fix for GHSA-fc86-6rv6-2jpm. The cap does
not stop the traversal: once exceeded, findConflict() returns a freshly
allocated conflict for every remaining pair instead of null, so the nested
loops keep running and the conflict list grows quadratically.
Measured against a 33 KB query of 1,000 aliased fields differing only in
argument order, on PHP with a 256 MB limit:
15.32.1 (trunk) 0 errors, 4.26s, 20 MB
15.32.3 fatal, memory exhausted
15.37.1 fatal, memory exhausted
15.32.3 + this change 0 errors, 4.57s, 20 MB
So the upgrade on its own turns a slow validation into an out-of-memory
fatal, which is a harder failure than the quadratic time the cap was meant to
bound. Upstream has not fixed this as of 15.37.1.
The controller already builds its own rule list, so the default instance is
swapped for one constructed with an effectively unlimited cap. Query size
stays bounded by the existing depth and complexity rules. The parser
recursion limit from GHSA-r7cg-qjjm-xhqq is unaffected and still applies.
Note for the tracking issue: Dependabot will mark GHSA-fc86-6rv6-2jpm
resolved because the lock moves to 15.32.3, but this change deliberately
opts out of that advisory's mitigation. The quadratic-time behaviour is
unchanged from trunk and needs an upstream fix.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
* Refresh the code-API source hash after the controller change
StalenessChecker hashes every .php file under src/Api/ and compares the
result to api_source_hash.txt, so editing GraphQLControllerBase invalidates
it and fails the GraphQL API Staleness Check.
Only the hash file is committed. Running the full generator also reorders
fields in RootQueryType and RootMutationType (product/products and
coupon/coupons swap places), which is generator nondeterminism across
platforms rather than an effect of this branch — the staleness check only
compares the source hash, so that churn is left out.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
* Add a changelog entry for the beta tester dependency changes
The PHPUnit removal and the symfony/process bump change this project, so it
needs its own change file in this PR. The entry in the parent branch covers
only the lock bumps that landed there.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FzKh9uTzTKoJKq7ofWM89V
* Keep the GraphQL field-comparison cap and make it memory-safe
The previous approach disabled graphql-php's new OverlappingFieldsCanBeMerged
comparison cap by passing PHP_INT_MAX. That avoided the memory exhaustion the
upstream cap causes, but it also removed the bound the cap exists to provide,
and the code comment claiming the depth and complexity rules bound the cost
instead was wrong: DocumentValidator runs every rule in a single parallel
traversal, and QueryDepth and QueryComplexity both report only once that
traversal has finished, so neither can stop the comparisons.
BoundedOverlappingFieldsCanBeMerged keeps the upstream 100,000 cap and stops
comparing once it is exceeded. The first over-limit comparison still yields
the upstream "Too many field comparisons" conflict, which invalidates the
query; later comparisons short-circuit, so nothing further is allocated.
Measured on PHP 8.4 with a 256 MB limit, validating one response name whose
fields differ only in argument order:
fields | stock 15.32.3 | PHP_INT_MAX | this change
1000 | OOM fatal | 0 errors, 4.3s | 1 error, 1.1s
3000 | OOM fatal | 0 errors, 37.7s | 1 error, 1.9s
5040 | OOM fatal | 0 errors, 106.3s | 1 error, 2.8s
Only the stock rule instance is swapped, so a subclass registered through
DocumentValidator::addRule() is left in place.
Adds regression coverage for the cap and for the vendored parser's default
recursion limit.
* Simplify Composer security updates
* Update GraphQL dependency changelog
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
diff --git a/packages/js/create-woo-extension/changelog/update-php-dev-dependency-security-patches b/packages/js/create-woo-extension/changelog/update-php-dev-dependency-security-patches
new file mode 100644
index 00000000000..f002b0c10a8
--- /dev/null
+++ b/packages/js/create-woo-extension/changelog/update-php-dev-dependency-security-patches
@@ -0,0 +1,4 @@
+Significance: patch
+Type: dev
+
+Update PHP development dependencies to versions that resolve reported security advisories.
diff --git a/packages/js/create-woo-extension/composer.json b/packages/js/create-woo-extension/composer.json
index 34779f5cce5..32656b54585 100644
--- a/packages/js/create-woo-extension/composer.json
+++ b/packages/js/create-woo-extension/composer.json
@@ -4,6 +4,7 @@
"type": "library",
"license": "GPL-2.0-or-later",
"minimum-stability": "dev",
+ "prefer-stable": true,
"require-dev": {
"automattic/jetpack-changelogger": "3.3.0"
},
diff --git a/packages/js/create-woo-extension/composer.lock b/packages/js/create-woo-extension/composer.lock
index 32d9df34919..590fe87697a 100644
--- a/packages/js/create-woo-extension/composer.lock
+++ b/packages/js/create-woo-extension/composer.lock
@@ -4,7 +4,7 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
- "content-hash": "e22045358357e9c229d188944b337d8f",
+ "content-hash": "f0e7b9dcb192f6a349b56bc7642729ab",
"packages": [],
"packages-dev": [
{
@@ -352,22 +352,107 @@
],
"time": "2022-11-03T14:55:06+00:00"
},
+ {
+ "name": "symfony/polyfill-php80",
+ "version": "v1.37.0",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/symfony/polyfill-php80.git",
+ "reference": "dfb55726c3a76ea3b6459fcfda1ec2d80a682411"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/symfony/polyfill-php80/zipball/dfb55726c3a76ea3b6459fcfda1ec2d80a682411",
+ "reference": "dfb55726c3a76ea3b6459fcfda1ec2d80a682411",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=7.2"
+ },
+ "type": "library",
+ "extra": {
+ "thanks": {
+ "url": "https://github.com/symfony/polyfill",
+ "name": "symfony/polyfill"
+ }
+ },
+ "autoload": {
+ "files": [
+ "bootstrap.php"
+ ],
+ "psr-4": {
+ "Symfony\\Polyfill\\Php80\\": ""
+ },
+ "classmap": [
+ "Resources/stubs"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Ion Bazan",
+ "email": "ion.bazan@gmail.com"
+ },
+ {
+ "name": "Nicolas Grekas",
+ "email": "p@tchwork.com"
+ },
+ {
+ "name": "Symfony Community",
+ "homepage": "https://symfony.com/contributors"
+ }
+ ],
+ "description": "Symfony polyfill backporting some PHP 8.0+ features to lower PHP versions",
+ "homepage": "https://symfony.com",
+ "keywords": [
+ "compatibility",
+ "polyfill",
+ "portable",
+ "shim"
+ ],
+ "support": {
+ "source": "https://github.com/symfony/polyfill-php80/tree/v1.37.0"
+ },
+ "funding": [
+ {
+ "url": "https://symfony.com/sponsor",
+ "type": "custom"
+ },
+ {
+ "url": "https://github.com/fabpot",
+ "type": "github"
+ },
+ {
+ "url": "https://github.com/nicolas-grekas",
+ "type": "github"
+ },
+ {
+ "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+ "type": "tidelift"
+ }
+ ],
+ "time": "2026-04-10T16:19:22+00:00"
+ },
{
"name": "symfony/process",
- "version": "3.4.x-dev",
+ "version": "v5.4.51",
"source": {
"type": "git",
"url": "https://github.com/symfony/process.git",
- "reference": "b8648cf1d5af12a44a51d07ef9bf980921f15fca"
+ "reference": "467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/process/zipball/b8648cf1d5af12a44a51d07ef9bf980921f15fca",
- "reference": "b8648cf1d5af12a44a51d07ef9bf980921f15fca",
+ "url": "https://api.github.com/repos/symfony/process/zipball/467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f",
+ "reference": "467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f",
"shasum": ""
},
"require": {
- "php": "^5.5.9|>=7.0.8"
+ "php": ">=7.2.5",
+ "symfony/polyfill-php80": "^1.16"
},
"type": "library",
"autoload": {
@@ -392,10 +477,10 @@
"homepage": "https://symfony.com/contributors"
}
],
- "description": "Symfony Process Component",
+ "description": "Executes commands in sub-processes",
"homepage": "https://symfony.com",
"support": {
- "source": "https://github.com/symfony/process/tree/3.4"
+ "source": "https://github.com/symfony/process/tree/v5.4.51"
},
"funding": [
{
@@ -406,12 +491,16 @@
"url": "https://github.com/fabpot",
"type": "github"
},
+ {
+ "url": "https://github.com/nicolas-grekas",
+ "type": "github"
+ },
{
"url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
"type": "tidelift"
}
],
- "time": "2020-10-24T10:57:07+00:00"
+ "time": "2026-01-26T15:53:37+00:00"
},
{
"name": "wikimedia/at-ease",
@@ -471,13 +560,13 @@
],
"aliases": [],
"minimum-stability": "dev",
- "stability-flags": [],
- "prefer-stable": false,
+ "stability-flags": {},
+ "prefer-stable": true,
"prefer-lowest": false,
- "platform": [],
- "platform-dev": [],
+ "platform": {},
+ "platform-dev": {},
"platform-overrides": {
- "php": "7.2"
+ "php": "7.4"
},
- "plugin-api-version": "2.3.0"
+ "plugin-api-version": "2.9.0"
}
diff --git a/packages/js/extend-cart-checkout-block/changelog/update-php-dev-dependency-security-patches b/packages/js/extend-cart-checkout-block/changelog/update-php-dev-dependency-security-patches
new file mode 100644
index 00000000000..f002b0c10a8
--- /dev/null
+++ b/packages/js/extend-cart-checkout-block/changelog/update-php-dev-dependency-security-patches
@@ -0,0 +1,4 @@
+Significance: patch
+Type: dev
+
+Update PHP development dependencies to versions that resolve reported security advisories.
diff --git a/packages/js/extend-cart-checkout-block/composer.json b/packages/js/extend-cart-checkout-block/composer.json
index 53393e89d31..52b94890aa1 100644
--- a/packages/js/extend-cart-checkout-block/composer.json
+++ b/packages/js/extend-cart-checkout-block/composer.json
@@ -4,6 +4,7 @@
"type": "library",
"license": "GPL-2.0-or-later",
"minimum-stability": "dev",
+ "prefer-stable": true,
"require-dev": {
"automattic/jetpack-changelogger": "3.3.0"
},
diff --git a/packages/js/extend-cart-checkout-block/composer.lock b/packages/js/extend-cart-checkout-block/composer.lock
index 32d9df34919..590fe87697a 100644
--- a/packages/js/extend-cart-checkout-block/composer.lock
+++ b/packages/js/extend-cart-checkout-block/composer.lock
@@ -4,7 +4,7 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
- "content-hash": "e22045358357e9c229d188944b337d8f",
+ "content-hash": "f0e7b9dcb192f6a349b56bc7642729ab",
"packages": [],
"packages-dev": [
{
@@ -352,22 +352,107 @@
],
"time": "2022-11-03T14:55:06+00:00"
},
+ {
+ "name": "symfony/polyfill-php80",
+ "version": "v1.37.0",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/symfony/polyfill-php80.git",
+ "reference": "dfb55726c3a76ea3b6459fcfda1ec2d80a682411"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/symfony/polyfill-php80/zipball/dfb55726c3a76ea3b6459fcfda1ec2d80a682411",
+ "reference": "dfb55726c3a76ea3b6459fcfda1ec2d80a682411",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=7.2"
+ },
+ "type": "library",
+ "extra": {
+ "thanks": {
+ "url": "https://github.com/symfony/polyfill",
+ "name": "symfony/polyfill"
+ }
+ },
+ "autoload": {
+ "files": [
+ "bootstrap.php"
+ ],
+ "psr-4": {
+ "Symfony\\Polyfill\\Php80\\": ""
+ },
+ "classmap": [
+ "Resources/stubs"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Ion Bazan",
+ "email": "ion.bazan@gmail.com"
+ },
+ {
+ "name": "Nicolas Grekas",
+ "email": "p@tchwork.com"
+ },
+ {
+ "name": "Symfony Community",
+ "homepage": "https://symfony.com/contributors"
+ }
+ ],
+ "description": "Symfony polyfill backporting some PHP 8.0+ features to lower PHP versions",
+ "homepage": "https://symfony.com",
+ "keywords": [
+ "compatibility",
+ "polyfill",
+ "portable",
+ "shim"
+ ],
+ "support": {
+ "source": "https://github.com/symfony/polyfill-php80/tree/v1.37.0"
+ },
+ "funding": [
+ {
+ "url": "https://symfony.com/sponsor",
+ "type": "custom"
+ },
+ {
+ "url": "https://github.com/fabpot",
+ "type": "github"
+ },
+ {
+ "url": "https://github.com/nicolas-grekas",
+ "type": "github"
+ },
+ {
+ "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+ "type": "tidelift"
+ }
+ ],
+ "time": "2026-04-10T16:19:22+00:00"
+ },
{
"name": "symfony/process",
- "version": "3.4.x-dev",
+ "version": "v5.4.51",
"source": {
"type": "git",
"url": "https://github.com/symfony/process.git",
- "reference": "b8648cf1d5af12a44a51d07ef9bf980921f15fca"
+ "reference": "467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/process/zipball/b8648cf1d5af12a44a51d07ef9bf980921f15fca",
- "reference": "b8648cf1d5af12a44a51d07ef9bf980921f15fca",
+ "url": "https://api.github.com/repos/symfony/process/zipball/467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f",
+ "reference": "467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f",
"shasum": ""
},
"require": {
- "php": "^5.5.9|>=7.0.8"
+ "php": ">=7.2.5",
+ "symfony/polyfill-php80": "^1.16"
},
"type": "library",
"autoload": {
@@ -392,10 +477,10 @@
"homepage": "https://symfony.com/contributors"
}
],
- "description": "Symfony Process Component",
+ "description": "Executes commands in sub-processes",
"homepage": "https://symfony.com",
"support": {
- "source": "https://github.com/symfony/process/tree/3.4"
+ "source": "https://github.com/symfony/process/tree/v5.4.51"
},
"funding": [
{
@@ -406,12 +491,16 @@
"url": "https://github.com/fabpot",
"type": "github"
},
+ {
+ "url": "https://github.com/nicolas-grekas",
+ "type": "github"
+ },
{
"url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
"type": "tidelift"
}
],
- "time": "2020-10-24T10:57:07+00:00"
+ "time": "2026-01-26T15:53:37+00:00"
},
{
"name": "wikimedia/at-ease",
@@ -471,13 +560,13 @@
],
"aliases": [],
"minimum-stability": "dev",
- "stability-flags": [],
- "prefer-stable": false,
+ "stability-flags": {},
+ "prefer-stable": true,
"prefer-lowest": false,
- "platform": [],
- "platform-dev": [],
+ "platform": {},
+ "platform-dev": {},
"platform-overrides": {
- "php": "7.2"
+ "php": "7.4"
},
- "plugin-api-version": "2.3.0"
+ "plugin-api-version": "2.9.0"
}
diff --git a/plugins/woocommerce-beta-tester/changelog/dev-drop-phpunit-and-bump-symfony-process b/plugins/woocommerce-beta-tester/changelog/dev-drop-phpunit-and-bump-symfony-process
new file mode 100644
index 00000000000..ad2adeda1dc
--- /dev/null
+++ b/plugins/woocommerce-beta-tester/changelog/dev-drop-phpunit-and-bump-symfony-process
@@ -0,0 +1,4 @@
+Significance: patch
+Type: dev
+
+Remove the unused PHPUnit dev dependency and move symfony/process to a patched version.
diff --git a/plugins/woocommerce-beta-tester/composer.json b/plugins/woocommerce-beta-tester/composer.json
index fa2024ed0d2..a6d1ef584d1 100644
--- a/plugins/woocommerce-beta-tester/composer.json
+++ b/plugins/woocommerce-beta-tester/composer.json
@@ -11,14 +11,10 @@
"composer/installers": "~1.7"
},
"require-dev": {
- "phpunit/phpunit": "^6.5 || ^7.5",
"woocommerce/woocommerce-sniffs": "^1.0.0",
"automattic/jetpack-changelogger": "3.3.0"
},
"scripts": {
- "test": [
- "phpunit"
- ],
"phpcs": [
"phpcs -s -p"
],
@@ -31,7 +27,6 @@
},
"extra": {
"scripts-description": {
- "test": "Run unit tests",
"phpcs": "Analyze code against the WordPress coding standards with PHP_CodeSniffer",
"phpcbf": "Fix coding standards warnings/errors automatically with PHP Code Beautifier"
},
@@ -54,7 +49,7 @@
},
"config": {
"platform": {
- "php": "7.2"
+ "php": "7.4"
},
"allow-plugins": {
"composer/installers": true,
diff --git a/plugins/woocommerce-beta-tester/composer.lock b/plugins/woocommerce-beta-tester/composer.lock
index ed70d156b5f..4f8c5c69b13 100644
--- a/plugins/woocommerce-beta-tester/composer.lock
+++ b/plugins/woocommerce-beta-tester/composer.lock
@@ -4,7 +4,7 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
- "content-hash": "a78fa8ae81de7aa7b906234f4b27b5b3",
+ "content-hash": "d3694c9af970ec9bc673e6f81785ac2e",
"packages": [
{
"name": "composer/installers",
@@ -312,246 +312,6 @@
],
"time": "2026-05-06T08:26:05+00:00"
},
- {
- "name": "doctrine/instantiator",
- "version": "1.5.0",
- "source": {
- "type": "git",
- "url": "https://github.com/doctrine/instantiator.git",
- "reference": "0a0fa9780f5d4e507415a065172d26a98d02047b"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/doctrine/instantiator/zipball/0a0fa9780f5d4e507415a065172d26a98d02047b",
- "reference": "0a0fa9780f5d4e507415a065172d26a98d02047b",
- "shasum": ""
- },
- "require": {
- "php": "^7.1 || ^8.0"
- },
- "require-dev": {
- "doctrine/coding-standard": "^9 || ^11",
- "ext-pdo": "*",
- "ext-phar": "*",
- "phpbench/phpbench": "^0.16 || ^1",
- "phpstan/phpstan": "^1.4",
- "phpstan/phpstan-phpunit": "^1",
- "phpunit/phpunit": "^7.5 || ^8.5 || ^9.5",
- "vimeo/psalm": "^4.30 || ^5.4"
- },
- "type": "library",
- "autoload": {
- "psr-4": {
- "Doctrine\\Instantiator\\": "src/Doctrine/Instantiator/"
- }
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "MIT"
- ],
- "authors": [
- {
- "name": "Marco Pivetta",
- "email": "ocramius@gmail.com",
- "homepage": "https://ocramius.github.io/"
- }
- ],
- "description": "A small, lightweight utility to instantiate objects in PHP without invoking their constructors",
- "homepage": "https://www.doctrine-project.org/projects/instantiator.html",
- "keywords": [
- "constructor",
- "instantiate"
- ],
- "support": {
- "issues": "https://github.com/doctrine/instantiator/issues",
- "source": "https://github.com/doctrine/instantiator/tree/1.5.0"
- },
- "funding": [
- {
- "url": "https://www.doctrine-project.org/sponsorship.html",
- "type": "custom"
- },
- {
- "url": "https://www.patreon.com/phpdoctrine",
- "type": "patreon"
- },
- {
- "url": "https://tidelift.com/funding/github/packagist/doctrine%2Finstantiator",
- "type": "tidelift"
- }
- ],
- "time": "2022-12-30T00:15:36+00:00"
- },
- {
- "name": "myclabs/deep-copy",
- "version": "1.13.4",
- "source": {
- "type": "git",
- "url": "https://github.com/myclabs/DeepCopy.git",
- "reference": "07d290f0c47959fd5eed98c95ee5602db07e0b6a"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/myclabs/DeepCopy/zipball/07d290f0c47959fd5eed98c95ee5602db07e0b6a",
- "reference": "07d290f0c47959fd5eed98c95ee5602db07e0b6a",
- "shasum": ""
- },
- "require": {
- "php": "^7.1 || ^8.0"
- },
- "conflict": {
- "doctrine/collections": "<1.6.8",
- "doctrine/common": "<2.13.3 || >=3 <3.2.2"
- },
- "require-dev": {
- "doctrine/collections": "^1.6.8",
- "doctrine/common": "^2.13.3 || ^3.2.2",
- "phpspec/prophecy": "^1.10",
- "phpunit/phpunit": "^7.5.20 || ^8.5.23 || ^9.5.13"
- },
- "type": "library",
- "autoload": {
- "files": [
- "src/DeepCopy/deep_copy.php"
- ],
- "psr-4": {
- "DeepCopy\\": "src/DeepCopy/"
- }
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "MIT"
- ],
- "description": "Create deep copies (clones) of your objects",
- "keywords": [
- "clone",
- "copy",
- "duplicate",
- "object",
- "object graph"
- ],
- "support": {
- "issues": "https://github.com/myclabs/DeepCopy/issues",
- "source": "https://github.com/myclabs/DeepCopy/tree/1.13.4"
- },
- "funding": [
- {
- "url": "https://tidelift.com/funding/github/packagist/myclabs/deep-copy",
- "type": "tidelift"
- }
- ],
- "time": "2025-08-01T08:46:24+00:00"
- },
- {
- "name": "phar-io/manifest",
- "version": "1.0.3",
- "source": {
- "type": "git",
- "url": "https://github.com/phar-io/manifest.git",
- "reference": "7761fcacf03b4d4f16e7ccb606d4879ca431fcf4"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/phar-io/manifest/zipball/7761fcacf03b4d4f16e7ccb606d4879ca431fcf4",
- "reference": "7761fcacf03b4d4f16e7ccb606d4879ca431fcf4",
- "shasum": ""
- },
- "require": {
- "ext-dom": "*",
- "ext-phar": "*",
- "phar-io/version": "^2.0",
- "php": "^5.6 || ^7.0"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "1.0.x-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Arne Blankerts",
- "email": "arne@blankerts.de",
- "role": "Developer"
- },
- {
- "name": "Sebastian Heuer",
- "email": "sebastian@phpeople.de",
- "role": "Developer"
- },
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de",
- "role": "Developer"
- }
- ],
- "description": "Component for reading phar.io manifest information from a PHP Archive (PHAR)",
- "support": {
- "issues": "https://github.com/phar-io/manifest/issues",
- "source": "https://github.com/phar-io/manifest/tree/master"
- },
- "time": "2018-07-08T19:23:20+00:00"
- },
- {
- "name": "phar-io/version",
- "version": "2.0.1",
- "source": {
- "type": "git",
- "url": "https://github.com/phar-io/version.git",
- "reference": "45a2ec53a73c70ce41d55cedef9063630abaf1b6"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/phar-io/version/zipball/45a2ec53a73c70ce41d55cedef9063630abaf1b6",
- "reference": "45a2ec53a73c70ce41d55cedef9063630abaf1b6",
- "shasum": ""
- },
- "require": {
- "php": "^5.6 || ^7.0"
- },
- "type": "library",
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Arne Blankerts",
- "email": "arne@blankerts.de",
- "role": "Developer"
- },
- {
- "name": "Sebastian Heuer",
- "email": "sebastian@phpeople.de",
- "role": "Developer"
- },
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de",
- "role": "Developer"
- }
- ],
- "description": "Library for handling version information and constraints",
- "support": {
- "issues": "https://github.com/phar-io/version/issues",
- "source": "https://github.com/phar-io/version/tree/master"
- },
- "time": "2018-07-08T19:19:57+00:00"
- },
{
"name": "phpcompatibility/php-compatibility",
"version": "9.3.5",
@@ -747,1556 +507,248 @@
},
"funding": [
{
- "url": "https://github.com/PHPCompatibility",
- "type": "github"
- },
- {
- "url": "https://github.com/jrfnl",
- "type": "github"
- },
- {
- "url": "https://opencollective.com/php_codesniffer",
- "type": "open_collective"
- },
- {
- "url": "https://thanks.dev/u/gh/phpcompatibility",
- "type": "thanks_dev"
- }
- ],
- "time": "2025-10-18T00:05:59+00:00"
- },
- {
- "name": "phpcsstandards/phpcsextra",
- "version": "1.5.1",
- "source": {
- "type": "git",
- "url": "https://github.com/PHPCSStandards/PHPCSExtra.git",
- "reference": "39467533fdb742446d68c1d10ac33d625ee0311c"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/PHPCSStandards/PHPCSExtra/zipball/39467533fdb742446d68c1d10ac33d625ee0311c",
- "reference": "39467533fdb742446d68c1d10ac33d625ee0311c",
- "shasum": ""
- },
- "require": {
- "php": ">=5.4",
- "phpcsstandards/phpcsutils": "^1.2.3",
- "squizlabs/php_codesniffer": "^3.13.5 || ^4.0.1"
- },
- "require-dev": {
- "php-parallel-lint/php-console-highlighter": "^1.0",
- "php-parallel-lint/php-parallel-lint": "^1.4.0",
- "phpcsstandards/phpcsdevcs": "^1.2.0",
- "phpcsstandards/phpcsdevtools": "^1.2.1",
- "phpunit/phpunit": "^4.5 || ^5.0 || ^6.0 || ^7.0 || ^8.0 || ^9.3.4"
- },
- "type": "phpcodesniffer-standard",
- "extra": {
- "branch-alias": {
- "dev-stable": "1.x-dev",
- "dev-develop": "1.x-dev"
- }
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "LGPL-3.0-or-later"
- ],
- "authors": [
- {
- "name": "Juliette Reinders Folmer",
- "homepage": "https://github.com/jrfnl",
- "role": "lead"
- },
- {
- "name": "Contributors",
- "homepage": "https://github.com/PHPCSStandards/PHPCSExtra/graphs/contributors"
- }
- ],
- "description": "A collection of sniffs and standards for use with PHP_CodeSniffer.",
- "keywords": [
- "PHP_CodeSniffer",
- "phpcbf",
- "phpcodesniffer-standard",
- "phpcs",
- "standards",
- "static analysis"
- ],
- "support": {
- "issues": "https://github.com/PHPCSStandards/PHPCSExtra/issues",
- "security": "https://github.com/PHPCSStandards/PHPCSExtra/security/policy",
- "source": "https://github.com/PHPCSStandards/PHPCSExtra"
- },
- "funding": [
- {
- "url": "https://github.com/PHPCSStandards",
- "type": "github"
- },
- {
- "url": "https://github.com/jrfnl",
- "type": "github"
- },
- {
- "url": "https://opencollective.com/php_codesniffer",
- "type": "open_collective"
- },
- {
- "url": "https://thanks.dev/u/gh/phpcsstandards",
- "type": "thanks_dev"
- }
- ],
- "time": "2026-07-27T11:13:17+00:00"
- },
- {
- "name": "phpcsstandards/phpcsutils",
- "version": "1.2.3",
- "source": {
- "type": "git",
- "url": "https://github.com/PHPCSStandards/PHPCSUtils.git",
- "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/5f35d9408c54d7b529501f3c688b6eae562aea1f",
- "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f",
- "shasum": ""
- },
- "require": {
- "dealerdirect/phpcodesniffer-composer-installer": "^0.4.1 || ^0.5 || ^0.6.2 || ^0.7 || ^1.0",
- "php": ">=5.4",
- "squizlabs/php_codesniffer": "^3.13.5 || ^4.0.1"
- },
- "require-dev": {
- "ext-filter": "*",
- "php-parallel-lint/php-console-highlighter": "^1.0",
- "php-parallel-lint/php-parallel-lint": "^1.4.0",
- "phpcsstandards/phpcsdevcs": "^1.2.0",
- "yoast/phpunit-polyfills": "^1.1.0 || ^2.0.0 || ^3.0.0"
- },
- "type": "phpcodesniffer-standard",
- "extra": {
- "branch-alias": {
- "dev-stable": "1.x-dev",
- "dev-develop": "1.x-dev"
- }
- },
- "autoload": {
- "classmap": [
- "PHPCSUtils/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "LGPL-3.0-or-later"
- ],
- "authors": [
- {
- "name": "Juliette Reinders Folmer",
- "homepage": "https://github.com/jrfnl",
- "role": "lead"
- },
- {
- "name": "Contributors",
- "homepage": "https://github.com/PHPCSStandards/PHPCSUtils/graphs/contributors"
- }
- ],
- "description": "A suite of utility functions for use with PHP_CodeSniffer",
- "homepage": "https://phpcsutils.com/",
- "keywords": [
- "PHP_CodeSniffer",
- "phpcbf",
- "phpcodesniffer-standard",
- "phpcs",
- "phpcs3",
- "phpcs4",
- "standards",
- "static analysis",
- "tokens",
- "utility"
- ],
- "support": {
- "docs": "https://phpcsutils.com/",
- "issues": "https://github.com/PHPCSStandards/PHPCSUtils/issues",
- "security": "https://github.com/PHPCSStandards/PHPCSUtils/security/policy",
- "source": "https://github.com/PHPCSStandards/PHPCSUtils"
- },
- "funding": [
- {
- "url": "https://github.com/PHPCSStandards",
- "type": "github"
- },
- {
- "url": "https://github.com/jrfnl",
- "type": "github"
- },
- {
- "url": "https://opencollective.com/php_codesniffer",
- "type": "open_collective"
- },
- {
- "url": "https://thanks.dev/u/gh/phpcsstandards",
- "type": "thanks_dev"
- }
- ],
- "time": "2026-07-27T10:28:41+00:00"
- },
- {
- "name": "phpdocumentor/reflection-common",
- "version": "2.2.0",
- "source": {
- "type": "git",
- "url": "https://github.com/phpDocumentor/ReflectionCommon.git",
- "reference": "1d01c49d4ed62f25aa84a747ad35d5a16924662b"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/phpDocumentor/ReflectionCommon/zipball/1d01c49d4ed62f25aa84a747ad35d5a16924662b",
- "reference": "1d01c49d4ed62f25aa84a747ad35d5a16924662b",
- "shasum": ""
- },
- "require": {
- "php": "^7.2 || ^8.0"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-2.x": "2.x-dev"
- }
- },
- "autoload": {
- "psr-4": {
- "phpDocumentor\\Reflection\\": "src/"
- }
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "MIT"
- ],
- "authors": [
- {
- "name": "Jaap van Otterdijk",
- "email": "opensource@ijaap.nl"
- }
- ],
- "description": "Common reflection classes used by phpdocumentor to reflect the code structure",
- "homepage": "http://www.phpdoc.org",
- "keywords": [
- "FQSEN",
- "phpDocumentor",
- "phpdoc",
- "reflection",
- "static analysis"
- ],
- "support": {
- "issues": "https://github.com/phpDocumentor/ReflectionCommon/issues",
- "source": "https://github.com/phpDocumentor/ReflectionCommon/tree/2.x"
- },
- "time": "2020-06-27T09:03:43+00:00"
- },
- {
- "name": "phpdocumentor/reflection-docblock",
- "version": "5.3.0",
- "source": {
- "type": "git",
- "url": "https://github.com/phpDocumentor/ReflectionDocBlock.git",
- "reference": "622548b623e81ca6d78b721c5e029f4ce664f170"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/phpDocumentor/ReflectionDocBlock/zipball/622548b623e81ca6d78b721c5e029f4ce664f170",
- "reference": "622548b623e81ca6d78b721c5e029f4ce664f170",
- "shasum": ""
- },
- "require": {
- "ext-filter": "*",
- "php": "^7.2 || ^8.0",
- "phpdocumentor/reflection-common": "^2.2",
- "phpdocumentor/type-resolver": "^1.3",
- "webmozart/assert": "^1.9.1"
- },
- "require-dev": {
- "mockery/mockery": "~1.3.2",
- "psalm/phar": "^4.8"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "5.x-dev"
- }
- },
- "autoload": {
- "psr-4": {
- "phpDocumentor\\Reflection\\": "src"
- }
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "MIT"
- ],
- "authors": [
- {
- "name": "Mike van Riel",
- "email": "me@mikevanriel.com"
- },
- {
- "name": "Jaap van Otterdijk",
- "email": "account@ijaap.nl"
- }
- ],
- "description": "With this component, a library can provide support for annotations via DocBlocks or otherwise retrieve information that is embedded in a DocBlock.",
- "support": {
- "issues": "https://github.com/phpDocumentor/ReflectionDocBlock/issues",
- "source": "https://github.com/phpDocumentor/ReflectionDocBlock/tree/5.3.0"
- },
- "time": "2021-10-19T17:43:47+00:00"
- },
- {
- "name": "phpdocumentor/type-resolver",
- "version": "1.6.1",
- "source": {
- "type": "git",
- "url": "https://github.com/phpDocumentor/TypeResolver.git",
- "reference": "77a32518733312af16a44300404e945338981de3"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/phpDocumentor/TypeResolver/zipball/77a32518733312af16a44300404e945338981de3",
- "reference": "77a32518733312af16a44300404e945338981de3",
- "shasum": ""
- },
- "require": {
- "php": "^7.2 || ^8.0",
- "phpdocumentor/reflection-common": "^2.0"
- },
- "require-dev": {
- "ext-tokenizer": "*",
- "psalm/phar": "^4.8"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-1.x": "1.x-dev"
- }
- },
- "autoload": {
- "psr-4": {
- "phpDocumentor\\Reflection\\": "src"
- }
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "MIT"
- ],
- "authors": [
- {
- "name": "Mike van Riel",
- "email": "me@mikevanriel.com"
- }
- ],
- "description": "A PSR-5 based resolver of Class names, Types and Structural Element Names",
- "support": {
- "issues": "https://github.com/phpDocumentor/TypeResolver/issues",
- "source": "https://github.com/phpDocumentor/TypeResolver/tree/1.6.1"
- },
- "time": "2022-03-15T21:29:03+00:00"
- },
- {
- "name": "phpspec/prophecy",
- "version": "v1.21.0",
- "source": {
- "type": "git",
- "url": "https://github.com/phpspec/prophecy.git",
- "reference": "7594ec2f6507dd6a5feaf4fa50c391d5274a5838"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/phpspec/prophecy/zipball/7594ec2f6507dd6a5feaf4fa50c391d5274a5838",
- "reference": "7594ec2f6507dd6a5feaf4fa50c391d5274a5838",
- "shasum": ""
- },
- "require": {
- "doctrine/instantiator": "^1.2 || ^2.0",
- "php": "^7.2 || 8.0.* || 8.1.* || 8.2.* || 8.3.* || 8.4.*",
- "phpdocumentor/reflection-docblock": "^5.2",
- "sebastian/comparator": "^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0",
- "sebastian/recursion-context": "^3.0 || ^4.0 || ^5.0 || ^6.0 || ^7.0"
- },
- "require-dev": {
- "friendsofphp/php-cs-fixer": "^3.40",
- "phpspec/phpspec": "^6.0 || ^7.0",
- "phpstan/phpstan": "^1.9",
- "phpunit/phpunit": "^8.0 || ^9.0 || ^10.0"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "1.x-dev"
- }
- },
- "autoload": {
- "psr-4": {
- "Prophecy\\": "src/Prophecy"
- }
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "MIT"
- ],
- "authors": [
- {
- "name": "Konstantin Kudryashov",
- "email": "ever.zet@gmail.com",
- "homepage": "http://everzet.com"
- },
- {
- "name": "Marcello Duarte",
- "email": "marcello.duarte@gmail.com"
- }
- ],
- "description": "Highly opinionated mocking framework for PHP 5.3+",
- "homepage": "https://github.com/phpspec/prophecy",
- "keywords": [
- "Double",
- "Dummy",
- "dev",
- "fake",
- "mock",
- "spy",
- "stub"
- ],
- "support": {
- "issues": "https://github.com/phpspec/prophecy/issues",
- "source": "https://github.com/phpspec/prophecy/tree/v1.21.0"
- },
- "time": "2025-04-29T11:13:33+00:00"
- },
- {
- "name": "phpunit/php-code-coverage",
- "version": "6.1.4",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/php-code-coverage.git",
- "reference": "807e6013b00af69b6c5d9ceb4282d0393dbb9d8d"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/807e6013b00af69b6c5d9ceb4282d0393dbb9d8d",
- "reference": "807e6013b00af69b6c5d9ceb4282d0393dbb9d8d",
- "shasum": ""
- },
- "require": {
- "ext-dom": "*",
- "ext-xmlwriter": "*",
- "php": "^7.1",
- "phpunit/php-file-iterator": "^2.0",
- "phpunit/php-text-template": "^1.2.1",
- "phpunit/php-token-stream": "^3.0",
- "sebastian/code-unit-reverse-lookup": "^1.0.1",
- "sebastian/environment": "^3.1 || ^4.0",
- "sebastian/version": "^2.0.1",
- "theseer/tokenizer": "^1.1"
- },
- "require-dev": {
- "phpunit/phpunit": "^7.0"
- },
- "suggest": {
- "ext-xdebug": "^2.6.0"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "6.1-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de",
- "role": "lead"
- }
- ],
- "description": "Library that provides collection, processing, and rendering functionality for PHP code coverage information.",
- "homepage": "https://github.com/sebastianbergmann/php-code-coverage",
- "keywords": [
- "coverage",
- "testing",
- "xunit"
- ],
- "support": {
- "issues": "https://github.com/sebastianbergmann/php-code-coverage/issues",
- "source": "https://github.com/sebastianbergmann/php-code-coverage/tree/master"
- },
- "time": "2018-10-31T16:06:48+00:00"
- },
- {
- "name": "phpunit/php-file-iterator",
- "version": "2.0.6",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/php-file-iterator.git",
- "reference": "69deeb8664f611f156a924154985fbd4911eb36b"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/69deeb8664f611f156a924154985fbd4911eb36b",
- "reference": "69deeb8664f611f156a924154985fbd4911eb36b",
- "shasum": ""
- },
- "require": {
- "php": ">=7.1"
- },
- "require-dev": {
- "phpunit/phpunit": "^8.5"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "2.0.x-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de",
- "role": "lead"
- }
- ],
- "description": "FilterIterator implementation that filters files based on a list of suffixes.",
- "homepage": "https://github.com/sebastianbergmann/php-file-iterator/",
- "keywords": [
- "filesystem",
- "iterator"
- ],
- "support": {
- "issues": "https://github.com/sebastianbergmann/php-file-iterator/issues",
- "source": "https://github.com/sebastianbergmann/php-file-iterator/tree/2.0.6"
- },
- "funding": [
- {
- "url": "https://github.com/sebastianbergmann",
- "type": "github"
- }
- ],
- "time": "2024-03-01T13:39:50+00:00"
- },
- {
- "name": "phpunit/php-text-template",
- "version": "1.2.1",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/php-text-template.git",
- "reference": "31f8b717e51d9a2afca6c9f046f5d69fc27c8686"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/php-text-template/zipball/31f8b717e51d9a2afca6c9f046f5d69fc27c8686",
- "reference": "31f8b717e51d9a2afca6c9f046f5d69fc27c8686",
- "shasum": ""
- },
- "require": {
- "php": ">=5.3.3"
- },
- "type": "library",
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de",
- "role": "lead"
- }
- ],
- "description": "Simple template engine.",
- "homepage": "https://github.com/sebastianbergmann/php-text-template/",
- "keywords": [
- "template"
- ],
- "support": {
- "issues": "https://github.com/sebastianbergmann/php-text-template/issues",
- "source": "https://github.com/sebastianbergmann/php-text-template/tree/1.2.1"
- },
- "time": "2015-06-21T13:50:34+00:00"
- },
- {
- "name": "phpunit/php-timer",
- "version": "2.1.4",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/php-timer.git",
- "reference": "a691211e94ff39a34811abd521c31bd5b305b0bb"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/php-timer/zipball/a691211e94ff39a34811abd521c31bd5b305b0bb",
- "reference": "a691211e94ff39a34811abd521c31bd5b305b0bb",
- "shasum": ""
- },
- "require": {
- "php": ">=7.1"
- },
- "require-dev": {
- "phpunit/phpunit": "^8.5"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "2.1-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de",
- "role": "lead"
- }
- ],
- "description": "Utility class for timing",
- "homepage": "https://github.com/sebastianbergmann/php-timer/",
- "keywords": [
- "timer"
- ],
- "support": {
- "issues": "https://github.com/sebastianbergmann/php-timer/issues",
- "source": "https://github.com/sebastianbergmann/php-timer/tree/2.1.4"
- },
- "funding": [
- {
- "url": "https://github.com/sebastianbergmann",
- "type": "github"
- }
- ],
- "time": "2024-03-01T13:42:41+00:00"
- },
- {
- "name": "phpunit/php-token-stream",
- "version": "3.1.3",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/php-token-stream.git",
- "reference": "9c1da83261628cb24b6a6df371b6e312b3954768"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/php-token-stream/zipball/9c1da83261628cb24b6a6df371b6e312b3954768",
- "reference": "9c1da83261628cb24b6a6df371b6e312b3954768",
- "shasum": ""
- },
- "require": {
- "ext-tokenizer": "*",
- "php": ">=7.1"
- },
- "require-dev": {
- "phpunit/phpunit": "^7.0"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "3.1-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de"
- }
- ],
- "description": "Wrapper around PHP's tokenizer extension.",
- "homepage": "https://github.com/sebastianbergmann/php-token-stream/",
- "keywords": [
- "tokenizer"
- ],
- "support": {
- "issues": "https://github.com/sebastianbergmann/php-token-stream/issues",
- "source": "https://github.com/sebastianbergmann/php-token-stream/tree/3.1.3"
- },
- "funding": [
- {
- "url": "https://github.com/sebastianbergmann",
- "type": "github"
- }
- ],
- "abandoned": true,
- "time": "2021-07-26T12:15:06+00:00"
- },
- {
- "name": "phpunit/phpunit",
- "version": "7.5.20",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/phpunit.git",
- "reference": "9467db479d1b0487c99733bb1e7944d32deded2c"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/9467db479d1b0487c99733bb1e7944d32deded2c",
- "reference": "9467db479d1b0487c99733bb1e7944d32deded2c",
- "shasum": ""
- },
- "require": {
- "doctrine/instantiator": "^1.1",
- "ext-dom": "*",
- "ext-json": "*",
- "ext-libxml": "*",
- "ext-mbstring": "*",
- "ext-xml": "*",
- "myclabs/deep-copy": "^1.7",
- "phar-io/manifest": "^1.0.2",
- "phar-io/version": "^2.0",
- "php": "^7.1",
- "phpspec/prophecy": "^1.7",
- "phpunit/php-code-coverage": "^6.0.7",
- "phpunit/php-file-iterator": "^2.0.1",
- "phpunit/php-text-template": "^1.2.1",
- "phpunit/php-timer": "^2.1",
- "sebastian/comparator": "^3.0",
- "sebastian/diff": "^3.0",
- "sebastian/environment": "^4.0",
- "sebastian/exporter": "^3.1",
- "sebastian/global-state": "^2.0",
- "sebastian/object-enumerator": "^3.0.3",
- "sebastian/resource-operations": "^2.0",
- "sebastian/version": "^2.0.1"
- },
- "conflict": {
- "phpunit/phpunit-mock-objects": "*"
- },
- "require-dev": {
- "ext-pdo": "*"
- },
- "suggest": {
- "ext-soap": "*",
- "ext-xdebug": "*",
- "phpunit/php-invoker": "^2.0"
- },
- "bin": [
- "phpunit"
- ],
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "7.5-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de",
- "role": "lead"
- }
- ],
- "description": "The PHP Unit Testing framework.",
- "homepage": "https://phpunit.de/",
- "keywords": [
- "phpunit",
- "testing",
- "xunit"
- ],
- "support": {
- "issues": "https://github.com/sebastianbergmann/phpunit/issues",
- "source": "https://github.com/sebastianbergmann/phpunit/tree/7.5.20"
- },
- "time": "2020-01-08T08:45:45+00:00"
- },
- {
- "name": "psr/log",
- "version": "1.1.4",
- "source": {
- "type": "git",
- "url": "https://github.com/php-fig/log.git",
- "reference": "d49695b909c3b7628b6289db5479a1c204601f11"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/php-fig/log/zipball/d49695b909c3b7628b6289db5479a1c204601f11",
- "reference": "d49695b909c3b7628b6289db5479a1c204601f11",
- "shasum": ""
- },
- "require": {
- "php": ">=5.3.0"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "1.1.x-dev"
- }
- },
- "autoload": {
- "psr-4": {
- "Psr\\Log\\": "Psr/Log/"
- }
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "MIT"
- ],
- "authors": [
- {
- "name": "PHP-FIG",
- "homepage": "https://www.php-fig.org/"
- }
- ],
- "description": "Common interface for logging libraries",
- "homepage": "https://github.com/php-fig/log",
- "keywords": [
- "log",
- "psr",
- "psr-3"
- ],
- "support": {
- "source": "https://github.com/php-fig/log/tree/1.1.4"
- },
- "time": "2021-05-03T11:20:27+00:00"
- },
- {
- "name": "sebastian/code-unit-reverse-lookup",
- "version": "1.0.3",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/code-unit-reverse-lookup.git",
- "reference": "92a1a52e86d34cde6caa54f1b5ffa9fda18e5d54"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/code-unit-reverse-lookup/zipball/92a1a52e86d34cde6caa54f1b5ffa9fda18e5d54",
- "reference": "92a1a52e86d34cde6caa54f1b5ffa9fda18e5d54",
- "shasum": ""
- },
- "require": {
- "php": ">=5.6"
- },
- "require-dev": {
- "phpunit/phpunit": "^8.5"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "1.0.x-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de"
- }
- ],
- "description": "Looks up which function or method a line of code belongs to",
- "homepage": "https://github.com/sebastianbergmann/code-unit-reverse-lookup/",
- "support": {
- "issues": "https://github.com/sebastianbergmann/code-unit-reverse-lookup/issues",
- "source": "https://github.com/sebastianbergmann/code-unit-reverse-lookup/tree/1.0.3"
- },
- "funding": [
- {
- "url": "https://github.com/sebastianbergmann",
- "type": "github"
- }
- ],
- "time": "2024-03-01T13:45:45+00:00"
- },
- {
- "name": "sebastian/comparator",
- "version": "3.0.6",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/comparator.git",
- "reference": "4b3c947888c81708b20fb081bb653a2ba68f989a"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/4b3c947888c81708b20fb081bb653a2ba68f989a",
- "reference": "4b3c947888c81708b20fb081bb653a2ba68f989a",
- "shasum": ""
- },
- "require": {
- "php": ">=7.1",
- "sebastian/diff": "^3.0",
- "sebastian/exporter": "^3.1"
- },
- "require-dev": {
- "phpunit/phpunit": "^8.5"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "3.0-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de"
- },
- {
- "name": "Jeff Welch",
- "email": "whatthejeff@gmail.com"
- },
- {
- "name": "Volker Dusch",
- "email": "github@wallbash.com"
- },
- {
- "name": "Bernhard Schussek",
- "email": "bschussek@2bepublished.at"
- }
- ],
- "description": "Provides the functionality to compare PHP values for equality",
- "homepage": "https://github.com/sebastianbergmann/comparator",
- "keywords": [
- "comparator",
- "compare",
- "equality"
- ],
- "support": {
- "issues": "https://github.com/sebastianbergmann/comparator/issues",
- "source": "https://github.com/sebastianbergmann/comparator/tree/3.0.6"
- },
- "funding": [
- {
- "url": "https://github.com/sebastianbergmann",
- "type": "github"
- },
- {
- "url": "https://liberapay.com/sebastianbergmann",
- "type": "liberapay"
- },
- {
- "url": "https://thanks.dev/u/gh/sebastianbergmann",
- "type": "thanks_dev"
- },
- {
- "url": "https://tidelift.com/funding/github/packagist/sebastian/comparator",
- "type": "tidelift"
- }
- ],
- "time": "2025-08-10T05:29:24+00:00"
- },
- {
- "name": "sebastian/diff",
- "version": "3.0.6",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/diff.git",
- "reference": "98ff311ca519c3aa73ccd3de053bdb377171d7b6"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/diff/zipball/98ff311ca519c3aa73ccd3de053bdb377171d7b6",
- "reference": "98ff311ca519c3aa73ccd3de053bdb377171d7b6",
- "shasum": ""
- },
- "require": {
- "php": ">=7.1"
- },
- "require-dev": {
- "phpunit/phpunit": "^7.5 || ^8.0",
- "symfony/process": "^2 || ^3.3 || ^4"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "3.0-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de"
- },
- {
- "name": "Kore Nordmann",
- "email": "mail@kore-nordmann.de"
- }
- ],
- "description": "Diff implementation",
- "homepage": "https://github.com/sebastianbergmann/diff",
- "keywords": [
- "diff",
- "udiff",
- "unidiff",
- "unified diff"
- ],
- "support": {
- "issues": "https://github.com/sebastianbergmann/diff/issues",
- "source": "https://github.com/sebastianbergmann/diff/tree/3.0.6"
- },
- "funding": [
- {
- "url": "https://github.com/sebastianbergmann",
- "type": "github"
- }
- ],
- "time": "2024-03-02T06:16:36+00:00"
- },
- {
- "name": "sebastian/environment",
- "version": "4.2.5",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/environment.git",
- "reference": "56932f6049a0482853056ffd617c91ffcc754205"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/environment/zipball/56932f6049a0482853056ffd617c91ffcc754205",
- "reference": "56932f6049a0482853056ffd617c91ffcc754205",
- "shasum": ""
- },
- "require": {
- "php": ">=7.1"
- },
- "require-dev": {
- "phpunit/phpunit": "^7.5"
- },
- "suggest": {
- "ext-posix": "*"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "4.2-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de"
- }
- ],
- "description": "Provides functionality to handle HHVM/PHP environments",
- "homepage": "http://www.github.com/sebastianbergmann/environment",
- "keywords": [
- "Xdebug",
- "environment",
- "hhvm"
- ],
- "support": {
- "issues": "https://github.com/sebastianbergmann/environment/issues",
- "source": "https://github.com/sebastianbergmann/environment/tree/4.2.5"
- },
- "funding": [
- {
- "url": "https://github.com/sebastianbergmann",
- "type": "github"
- }
- ],
- "time": "2024-03-01T13:49:59+00:00"
- },
- {
- "name": "sebastian/exporter",
- "version": "3.1.8",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/exporter.git",
- "reference": "64cfeaa341951ceb2019d7b98232399d57bb2296"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/exporter/zipball/64cfeaa341951ceb2019d7b98232399d57bb2296",
- "reference": "64cfeaa341951ceb2019d7b98232399d57bb2296",
- "shasum": ""
- },
- "require": {
- "php": ">=7.2",
- "sebastian/recursion-context": "^3.0"
- },
- "require-dev": {
- "ext-mbstring": "*",
- "phpunit/phpunit": "^8.5"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "3.1.x-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de"
- },
- {
- "name": "Jeff Welch",
- "email": "whatthejeff@gmail.com"
- },
- {
- "name": "Volker Dusch",
- "email": "github@wallbash.com"
- },
- {
- "name": "Adam Harvey",
- "email": "aharvey@php.net"
- },
- {
- "name": "Bernhard Schussek",
- "email": "bschussek@gmail.com"
- }
- ],
- "description": "Provides the functionality to export PHP variables for visualization",
- "homepage": "http://www.github.com/sebastianbergmann/exporter",
- "keywords": [
- "export",
- "exporter"
- ],
- "support": {
- "issues": "https://github.com/sebastianbergmann/exporter/issues",
- "source": "https://github.com/sebastianbergmann/exporter/tree/3.1.8"
- },
- "funding": [
- {
- "url": "https://github.com/sebastianbergmann",
- "type": "github"
- },
- {
- "url": "https://liberapay.com/sebastianbergmann",
- "type": "liberapay"
- },
- {
- "url": "https://thanks.dev/u/gh/sebastianbergmann",
- "type": "thanks_dev"
- },
- {
- "url": "https://tidelift.com/funding/github/packagist/sebastian/exporter",
- "type": "tidelift"
- }
- ],
- "time": "2025-09-24T05:55:14+00:00"
- },
- {
- "name": "sebastian/global-state",
- "version": "2.0.0",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/global-state.git",
- "reference": "e8ba02eed7bbbb9e59e43dedd3dddeff4a56b0c4"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/global-state/zipball/e8ba02eed7bbbb9e59e43dedd3dddeff4a56b0c4",
- "reference": "e8ba02eed7bbbb9e59e43dedd3dddeff4a56b0c4",
- "shasum": ""
- },
- "require": {
- "php": "^7.0"
- },
- "require-dev": {
- "phpunit/phpunit": "^6.0"
- },
- "suggest": {
- "ext-uopz": "*"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "2.0-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de"
- }
- ],
- "description": "Snapshotting of global state",
- "homepage": "http://www.github.com/sebastianbergmann/global-state",
- "keywords": [
- "global state"
- ],
- "support": {
- "issues": "https://github.com/sebastianbergmann/global-state/issues",
- "source": "https://github.com/sebastianbergmann/global-state/tree/2.0.0"
- },
- "time": "2017-04-27T15:39:26+00:00"
- },
- {
- "name": "sebastian/object-enumerator",
- "version": "3.0.5",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/object-enumerator.git",
- "reference": "ac5b293dba925751b808e02923399fb44ff0d541"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/object-enumerator/zipball/ac5b293dba925751b808e02923399fb44ff0d541",
- "reference": "ac5b293dba925751b808e02923399fb44ff0d541",
- "shasum": ""
- },
- "require": {
- "php": ">=7.0",
- "sebastian/object-reflector": "^1.1.1",
- "sebastian/recursion-context": "^3.0"
- },
- "require-dev": {
- "phpunit/phpunit": "^6.0"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "3.0.x-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de"
- }
- ],
- "description": "Traverses array structures and object graphs to enumerate all referenced objects",
- "homepage": "https://github.com/sebastianbergmann/object-enumerator/",
- "support": {
- "issues": "https://github.com/sebastianbergmann/object-enumerator/issues",
- "source": "https://github.com/sebastianbergmann/object-enumerator/tree/3.0.5"
- },
- "funding": [
- {
- "url": "https://github.com/sebastianbergmann",
- "type": "github"
- }
- ],
- "time": "2024-03-01T13:54:02+00:00"
- },
- {
- "name": "sebastian/object-reflector",
- "version": "1.1.3",
- "source": {
- "type": "git",
- "url": "https://github.com/sebastianbergmann/object-reflector.git",
- "reference": "1d439c229e61f244ff1f211e5c99737f90c67def"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/object-reflector/zipball/1d439c229e61f244ff1f211e5c99737f90c67def",
- "reference": "1d439c229e61f244ff1f211e5c99737f90c67def",
- "shasum": ""
- },
- "require": {
- "php": ">=7.0"
- },
- "require-dev": {
- "phpunit/phpunit": "^6.0"
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "1.1-dev"
- }
- },
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "BSD-3-Clause"
- ],
- "authors": [
- {
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de"
- }
- ],
- "description": "Allows reflection of object attributes, including inherited and non-public ones",
- "homepage": "https://github.com/sebastianbergmann/object-reflector/",
- "support": {
- "issues": "https://github.com/sebastianbergmann/object-reflector/issues",
- "source": "https://github.com/sebastianbergmann/object-reflector/tree/1.1.3"
- },
- "funding": [
- {
- "url": "https://github.com/sebastianbergmann",
+ "url": "https://github.com/PHPCompatibility",
+ "type": "github"
+ },
+ {
+ "url": "https://github.com/jrfnl",
"type": "github"
+ },
+ {
+ "url": "https://opencollective.com/php_codesniffer",
+ "type": "open_collective"
+ },
+ {
+ "url": "https://thanks.dev/u/gh/phpcompatibility",
+ "type": "thanks_dev"
}
],
- "time": "2024-03-01T13:56:04+00:00"
+ "time": "2025-10-18T00:05:59+00:00"
},
{
- "name": "sebastian/recursion-context",
- "version": "3.0.3",
+ "name": "phpcsstandards/phpcsextra",
+ "version": "1.5.1",
"source": {
"type": "git",
- "url": "https://github.com/sebastianbergmann/recursion-context.git",
- "reference": "8fe7e75986a9d24b4cceae847314035df7703a5a"
+ "url": "https://github.com/PHPCSStandards/PHPCSExtra.git",
+ "reference": "39467533fdb742446d68c1d10ac33d625ee0311c"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/recursion-context/zipball/8fe7e75986a9d24b4cceae847314035df7703a5a",
- "reference": "8fe7e75986a9d24b4cceae847314035df7703a5a",
+ "url": "https://api.github.com/repos/PHPCSStandards/PHPCSExtra/zipball/39467533fdb742446d68c1d10ac33d625ee0311c",
+ "reference": "39467533fdb742446d68c1d10ac33d625ee0311c",
"shasum": ""
},
"require": {
- "php": ">=7.0"
+ "php": ">=5.4",
+ "phpcsstandards/phpcsutils": "^1.2.3",
+ "squizlabs/php_codesniffer": "^3.13.5 || ^4.0.1"
},
"require-dev": {
- "phpunit/phpunit": "^6.0"
+ "php-parallel-lint/php-console-highlighter": "^1.0",
+ "php-parallel-lint/php-parallel-lint": "^1.4.0",
+ "phpcsstandards/phpcsdevcs": "^1.2.0",
+ "phpcsstandards/phpcsdevtools": "^1.2.1",
+ "phpunit/phpunit": "^4.5 || ^5.0 || ^6.0 || ^7.0 || ^8.0 || ^9.3.4"
},
- "type": "library",
+ "type": "phpcodesniffer-standard",
"extra": {
"branch-alias": {
- "dev-master": "3.0.x-dev"
+ "dev-stable": "1.x-dev",
+ "dev-develop": "1.x-dev"
}
},
- "autoload": {
- "classmap": [
- "src/"
- ]
- },
"notification-url": "https://packagist.org/downloads/",
"license": [
- "BSD-3-Clause"
+ "LGPL-3.0-or-later"
],
"authors": [
{
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de"
- },
- {
- "name": "Jeff Welch",
- "email": "whatthejeff@gmail.com"
+ "name": "Juliette Reinders Folmer",
+ "homepage": "https://github.com/jrfnl",
+ "role": "lead"
},
{
- "name": "Adam Harvey",
- "email": "aharvey@php.net"
+ "name": "Contributors",
+ "homepage": "https://github.com/PHPCSStandards/PHPCSExtra/graphs/contributors"
}
],
- "description": "Provides functionality to recursively process PHP variables",
- "homepage": "http://www.github.com/sebastianbergmann/recursion-context",
+ "description": "A collection of sniffs and standards for use with PHP_CodeSniffer.",
+ "keywords": [
+ "PHP_CodeSniffer",
+ "phpcbf",
+ "phpcodesniffer-standard",
+ "phpcs",
+ "standards",
+ "static analysis"
+ ],
"support": {
- "issues": "https://github.com/sebastianbergmann/recursion-context/issues",
- "source": "https://github.com/sebastianbergmann/recursion-context/tree/3.0.3"
+ "issues": "https://github.com/PHPCSStandards/PHPCSExtra/issues",
+ "security": "https://github.com/PHPCSStandards/PHPCSExtra/security/policy",
+ "source": "https://github.com/PHPCSStandards/PHPCSExtra"
},
"funding": [
{
- "url": "https://github.com/sebastianbergmann",
+ "url": "https://github.com/PHPCSStandards",
"type": "github"
},
{
- "url": "https://liberapay.com/sebastianbergmann",
- "type": "liberapay"
+ "url": "https://github.com/jrfnl",
+ "type": "github"
},
{
- "url": "https://thanks.dev/u/gh/sebastianbergmann",
- "type": "thanks_dev"
+ "url": "https://opencollective.com/php_codesniffer",
+ "type": "open_collective"
},
{
- "url": "https://tidelift.com/funding/github/packagist/sebastian/recursion-context",
- "type": "tidelift"
+ "url": "https://thanks.dev/u/gh/phpcsstandards",
+ "type": "thanks_dev"
}
],
- "time": "2025-08-10T05:25:53+00:00"
+ "time": "2026-07-27T11:13:17+00:00"
},
{
- "name": "sebastian/resource-operations",
- "version": "2.0.3",
+ "name": "phpcsstandards/phpcsutils",
+ "version": "1.2.3",
"source": {
"type": "git",
- "url": "https://github.com/sebastianbergmann/resource-operations.git",
- "reference": "72a7f7674d053d548003b16ff5a106e7e0e06eee"
+ "url": "https://github.com/PHPCSStandards/PHPCSUtils.git",
+ "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/resource-operations/zipball/72a7f7674d053d548003b16ff5a106e7e0e06eee",
- "reference": "72a7f7674d053d548003b16ff5a106e7e0e06eee",
+ "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/5f35d9408c54d7b529501f3c688b6eae562aea1f",
+ "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f",
"shasum": ""
},
"require": {
- "php": ">=7.1"
+ "dealerdirect/phpcodesniffer-composer-installer": "^0.4.1 || ^0.5 || ^0.6.2 || ^0.7 || ^1.0",
+ "php": ">=5.4",
+ "squizlabs/php_codesniffer": "^3.13.5 || ^4.0.1"
},
- "type": "library",
+ "require-dev": {
+ "ext-filter": "*",
+ "php-parallel-lint/php-console-highlighter": "^1.0",
+ "php-parallel-lint/php-parallel-lint": "^1.4.0",
+ "phpcsstandards/phpcsdevcs": "^1.2.0",
+ "yoast/phpunit-polyfills": "^1.1.0 || ^2.0.0 || ^3.0.0"
+ },
+ "type": "phpcodesniffer-standard",
"extra": {
"branch-alias": {
- "dev-master": "2.0-dev"
+ "dev-stable": "1.x-dev",
+ "dev-develop": "1.x-dev"
}
},
"autoload": {
"classmap": [
- "src/"
+ "PHPCSUtils/"
]
},
"notification-url": "https://packagist.org/downloads/",
"license": [
- "BSD-3-Clause"
+ "LGPL-3.0-or-later"
],
"authors": [
{
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de"
+ "name": "Juliette Reinders Folmer",
+ "homepage": "https://github.com/jrfnl",
+ "role": "lead"
+ },
+ {
+ "name": "Contributors",
+ "homepage": "https://github.com/PHPCSStandards/PHPCSUtils/graphs/contributors"
}
],
- "description": "Provides a list of PHP built-in functions that operate on resources",
- "homepage": "https://www.github.com/sebastianbergmann/resource-operations",
+ "description": "A suite of utility functions for use with PHP_CodeSniffer",
+ "homepage": "https://phpcsutils.com/",
+ "keywords": [
+ "PHP_CodeSniffer",
+ "phpcbf",
+ "phpcodesniffer-standard",
+ "phpcs",
+ "phpcs3",
+ "phpcs4",
+ "standards",
+ "static analysis",
+ "tokens",
+ "utility"
+ ],
"support": {
- "source": "https://github.com/sebastianbergmann/resource-operations/tree/2.0.3"
+ "docs": "https://phpcsutils.com/",
+ "issues": "https://github.com/PHPCSStandards/PHPCSUtils/issues",
+ "security": "https://github.com/PHPCSStandards/PHPCSUtils/security/policy",
+ "source": "https://github.com/PHPCSStandards/PHPCSUtils"
},
"funding": [
{
- "url": "https://github.com/sebastianbergmann",
+ "url": "https://github.com/PHPCSStandards",
+ "type": "github"
+ },
+ {
+ "url": "https://github.com/jrfnl",
"type": "github"
+ },
+ {
+ "url": "https://opencollective.com/php_codesniffer",
+ "type": "open_collective"
+ },
+ {
+ "url": "https://thanks.dev/u/gh/phpcsstandards",
+ "type": "thanks_dev"
}
],
- "time": "2024-03-01T13:59:09+00:00"
+ "time": "2026-07-27T10:28:41+00:00"
},
{
- "name": "sebastian/version",
- "version": "2.0.1",
+ "name": "psr/log",
+ "version": "1.1.4",
"source": {
"type": "git",
- "url": "https://github.com/sebastianbergmann/version.git",
- "reference": "99732be0ddb3361e16ad77b68ba41efc8e979019"
+ "url": "https://github.com/php-fig/log.git",
+ "reference": "d49695b909c3b7628b6289db5479a1c204601f11"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/version/zipball/99732be0ddb3361e16ad77b68ba41efc8e979019",
- "reference": "99732be0ddb3361e16ad77b68ba41efc8e979019",
+ "url": "https://api.github.com/repos/php-fig/log/zipball/d49695b909c3b7628b6289db5479a1c204601f11",
+ "reference": "d49695b909c3b7628b6289db5479a1c204601f11",
"shasum": ""
},
"require": {
- "php": ">=5.6"
+ "php": ">=5.3.0"
},
"type": "library",
"extra": {
"branch-alias": {
- "dev-master": "2.0.x-dev"
+ "dev-master": "1.1.x-dev"
}
},
"autoload": {
- "classmap": [
- "src/"
- ]
+ "psr-4": {
+ "Psr\\Log\\": "Psr/Log/"
+ }
},
"notification-url": "https://packagist.org/downloads/",
"license": [
- "BSD-3-Clause"
+ "MIT"
],
"authors": [
{
- "name": "Sebastian Bergmann",
- "email": "sebastian@phpunit.de",
- "role": "lead"
+ "name": "PHP-FIG",
+ "homepage": "https://www.php-fig.org/"
}
],
- "description": "Library that helps with managing the version number of Git-hosted PHP projects",
- "homepage": "https://github.com/sebastianbergmann/version",
+ "description": "Common interface for logging libraries",
+ "homepage": "https://github.com/php-fig/log",
+ "keywords": [
+ "log",
+ "psr",
+ "psr-3"
+ ],
"support": {
- "issues": "https://github.com/sebastianbergmann/version/issues",
- "source": "https://github.com/sebastianbergmann/version/tree/master"
+ "source": "https://github.com/php-fig/log/tree/1.1.4"
},
- "time": "2016-10-03T07:35:21+00:00"
+ "time": "2021-05-03T11:20:27+00:00"
},
{
"name": "squizlabs/php_codesniffer",
@@ -2616,29 +1068,38 @@
"time": "2024-12-23T08:48:59+00:00"
},
{
- "name": "symfony/process",
- "version": "v3.4.47",
+ "name": "symfony/polyfill-php80",
+ "version": "v1.37.0",
"source": {
"type": "git",
- "url": "https://github.com/symfony/process.git",
- "reference": "b8648cf1d5af12a44a51d07ef9bf980921f15fca"
+ "url": "https://github.com/symfony/polyfill-php80.git",
+ "reference": "dfb55726c3a76ea3b6459fcfda1ec2d80a682411"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/process/zipball/b8648cf1d5af12a44a51d07ef9bf980921f15fca",
- "reference": "b8648cf1d5af12a44a51d07ef9bf980921f15fca",
+ "url": "https://api.github.com/repos/symfony/polyfill-php80/zipball/dfb55726c3a76ea3b6459fcfda1ec2d80a682411",
+ "reference": "dfb55726c3a76ea3b6459fcfda1ec2d80a682411",
"shasum": ""
},
"require": {
- "php": "^5.5.9|>=7.0.8"
+ "php": ">=7.2"
},
"type": "library",
+ "extra": {
+ "thanks": {
+ "url": "https://github.com/symfony/polyfill",
+ "name": "symfony/polyfill"
+ }
+ },
"autoload": {
+ "files": [
+ "bootstrap.php"
+ ],
"psr-4": {
- "Symfony\\Component\\Process\\": ""
+ "Symfony\\Polyfill\\Php80\\": ""
},
- "exclude-from-classmap": [
- "/Tests/"
+ "classmap": [
+ "Resources/stubs"
]
},
"notification-url": "https://packagist.org/downloads/",
@@ -2647,18 +1108,28 @@
],
"authors": [
{
- "name": "Fabien Potencier",
- "email": "fabien@symfony.com"
+ "name": "Ion Bazan",
+ "email": "ion.bazan@gmail.com"
+ },
+ {
+ "name": "Nicolas Grekas",
+ "email": "p@tchwork.com"
},
{
"name": "Symfony Community",
"homepage": "https://symfony.com/contributors"
}
],
- "description": "Symfony Process Component",
+ "description": "Symfony polyfill backporting some PHP 8.0+ features to lower PHP versions",
"homepage": "https://symfony.com",
+ "keywords": [
+ "compatibility",
+ "polyfill",
+ "portable",
+ "shim"
+ ],
"support": {
- "source": "https://github.com/symfony/process/tree/v3.4.47"
+ "source": "https://github.com/symfony/polyfill-php80/tree/v1.37.0"
},
"funding": [
{
@@ -2669,120 +1140,82 @@
"url": "https://github.com/fabpot",
"type": "github"
},
+ {
+ "url": "https://github.com/nicolas-grekas",
+ "type": "github"
+ },
{
"url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
"type": "tidelift"
}
],
- "time": "2020-10-24T10:57:07+00:00"
+ "time": "2026-04-10T16:19:22+00:00"
},
{
- "name": "theseer/tokenizer",
- "version": "1.2.3",
+ "name": "symfony/process",
+ "version": "v5.4.51",
"source": {
"type": "git",
- "url": "https://github.com/theseer/tokenizer.git",
- "reference": "737eda637ed5e28c3413cb1ebe8bb52cbf1ca7a2"
+ "url": "https://github.com/symfony/process.git",
+ "reference": "467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/theseer/tokenizer/zipball/737eda637ed5e28c3413cb1ebe8bb52cbf1ca7a2",
- "reference": "737eda637ed5e28c3413cb1ebe8bb52cbf1ca7a2",
+ "url": "https://api.github.com/repos/symfony/process/zipball/467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f",
+ "reference": "467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f",
"shasum": ""
},
"require": {
- "ext-dom": "*",
- "ext-tokenizer": "*",
- "ext-xmlwriter": "*",
- "php": "^7.2 || ^8.0"
+ "php": ">=7.2.5",
+ "symfony/polyfill-php80": "^1.16"
},
"type": "library",
"autoload": {
- "classmap": [
- "src/"
+ "psr-4": {
+ "Symfony\\Component\\Process\\": ""
+ },
+ "exclude-from-classmap": [
+ "/Tests/"
]
},
"notification-url": "https://packagist.org/downloads/",
"license": [
- "BSD-3-Clause"
+ "MIT"
],
"authors": [
{
- "name": "Arne Blankerts",
- "email": "arne@blankerts.de",
- "role": "Developer"
+ "name": "Fabien Potencier",
+ "email": "fabien@symfony.com"
+ },
+ {
+ "name": "Symfony Community",
+ "homepage": "https://symfony.com/contributors"
}
],
- "description": "A small library for converting tokenized PHP source code into XML and potentially other formats",
+ "description": "Executes commands in sub-processes",
+ "homepage": "https://symfony.com",
"support": {
- "issues": "https://github.com/theseer/tokenizer/issues",
- "source": "https://github.com/theseer/tokenizer/tree/1.2.3"
+ "source": "https://github.com/symfony/process/tree/v5.4.51"
},
"funding": [
{
- "url": "https://github.com/theseer",
+ "url": "https://symfony.com/sponsor",
+ "type": "custom"
+ },
+ {
+ "url": "https://github.com/fabpot",
"type": "github"
- }
- ],
- "time": "2024-03-03T12:36:25+00:00"
- },
- {
- "name": "webmozart/assert",
- "version": "1.12.1",
- "source": {
- "type": "git",
- "url": "https://github.com/webmozarts/assert.git",
- "reference": "9be6926d8b485f55b9229203f962b51ed377ba68"
- },
- "dist": {
- "type": "zip",
- "url": "https://api.github.com/repos/webmozarts/assert/zipball/9be6926d8b485f55b9229203f962b51ed377ba68",
- "reference": "9be6926d8b485f55b9229203f962b51ed377ba68",
- "shasum": ""
- },
- "require": {
- "ext-ctype": "*",
- "ext-date": "*",
- "ext-filter": "*",
- "php": "^7.2 || ^8.0"
- },
- "suggest": {
- "ext-intl": "",
- "ext-simplexml": "",
- "ext-spl": ""
- },
- "type": "library",
- "extra": {
- "branch-alias": {
- "dev-master": "1.10-dev"
- }
- },
- "autoload": {
- "psr-4": {
- "Webmozart\\Assert\\": "src/"
- }
- },
- "notification-url": "https://packagist.org/downloads/",
- "license": [
- "MIT"
- ],
- "authors": [
+ },
+ {
+ "url": "https://github.com/nicolas-grekas",
+ "type": "github"
+ },
{
- "name": "Bernhard Schussek",
- "email": "bschussek@gmail.com"
+ "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+ "type": "tidelift"
}
],
- "description": "Assertions to validate method input/output with nice error messages.",
- "keywords": [
- "assert",
- "check",
- "validate"
- ],
- "support": {
- "issues": "https://github.com/webmozarts/assert/issues",
- "source": "https://github.com/webmozarts/assert/tree/1.12.1"
- },
- "time": "2025-10-29T15:56:20+00:00"
+ "time": "2026-01-26T15:53:37+00:00"
},
{
"name": "wikimedia/at-ease",
@@ -2953,7 +1386,7 @@
"platform": {},
"platform-dev": {},
"platform-overrides": {
- "php": "7.2"
+ "php": "7.4"
},
"plugin-api-version": "2.9.0"
}
diff --git a/plugins/woocommerce/changelog/update-vendored-graphql-php-security b/plugins/woocommerce/changelog/update-vendored-graphql-php-security
new file mode 100644
index 00000000000..e61d5c4ee9b
--- /dev/null
+++ b/plugins/woocommerce/changelog/update-vendored-graphql-php-security
@@ -0,0 +1,4 @@
+Significance: patch
+Type: update
+
+Update the vendored webonyx/graphql-php to 15.32.3 to limit parser recursion and field comparisons.
diff --git a/plugins/woocommerce/lib/composer.lock b/plugins/woocommerce/lib/composer.lock
index 224fe20025a..a696ad3ccc9 100644
--- a/plugins/woocommerce/lib/composer.lock
+++ b/plugins/woocommerce/lib/composer.lock
@@ -486,16 +486,16 @@
},
{
"name": "webonyx/graphql-php",
- "version": "v15.32.1",
+ "version": "v15.32.3",
"source": {
"type": "git",
"url": "https://github.com/webonyx/graphql-php.git",
- "reference": "e8f77f81dbe5de75551137955dd0fd3f779235cf"
+ "reference": "993bf0bea17f870412ad8a90f60c41cb8d5f1145"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/webonyx/graphql-php/zipball/e8f77f81dbe5de75551137955dd0fd3f779235cf",
- "reference": "e8f77f81dbe5de75551137955dd0fd3f779235cf",
+ "url": "https://api.github.com/repos/webonyx/graphql-php/zipball/993bf0bea17f870412ad8a90f60c41cb8d5f1145",
+ "reference": "993bf0bea17f870412ad8a90f60c41cb8d5f1145",
"shasum": ""
},
"require": {
@@ -513,7 +513,7 @@
"nyholm/psr7": "^1.5",
"phpbench/phpbench": "^1.2",
"phpstan/extension-installer": "^1.1",
- "phpstan/phpstan": "2.1.46",
+ "phpstan/phpstan": "2.1.51",
"phpstan/phpstan-phpunit": "2.0.16",
"phpstan/phpstan-strict-rules": "2.0.10",
"phpunit/phpunit": "^9.5 || ^10.5.21 || ^11",
@@ -550,7 +550,7 @@
],
"support": {
"issues": "https://github.com/webonyx/graphql-php/issues",
- "source": "https://github.com/webonyx/graphql-php/tree/v15.32.1"
+ "source": "https://github.com/webonyx/graphql-php/tree/v15.32.3"
},
"funding": [
{
@@ -562,7 +562,7 @@
"type": "open_collective"
}
],
- "time": "2026-04-21T09:42:39+00:00"
+ "time": "2026-04-24T13:49:35+00:00"
}
],
"aliases": [],
@@ -577,5 +577,5 @@
"platform-overrides": {
"php": "7.4"
},
- "plugin-api-version": "2.6.0"
+ "plugin-api-version": "2.9.0"
}
diff --git a/plugins/woocommerce/lib/packages/GraphQL/Language/Parser.php b/plugins/woocommerce/lib/packages/GraphQL/Language/Parser.php
index 8a79c081f56..69d16f39fe4 100644
--- a/plugins/woocommerce/lib/packages/GraphQL/Language/Parser.php
+++ b/plugins/woocommerce/lib/packages/GraphQL/Language/Parser.php
@@ -65,7 +65,8 @@ use Automattic\WooCommerce\Vendor\GraphQL\Language\AST\VariableNode;
* noLocation?: bool,
* allowLegacySDLEmptyFields?: bool,
* allowLegacySDLImplementsInterfaces?: bool,
- * experimentalFragmentVariables?: bool
+ * experimentalFragmentVariables?: bool,
+ * recursionLimit?: int<0, max>
* }
*
* - **noLocation**:
@@ -95,6 +96,11 @@ use Automattic\WooCommerce\Vendor\GraphQL\Language\AST\VariableNode;
*
* Note: this feature is experimental and may change or be removed in the future.
*
+ * - **recursionLimit**:
+ * Limits the depth of recursion during parsing to prevent stack overflows from deeply nested queries.
+ * The counter is shared across `parseSelectionSet`, `parseValueLiteral`, and `parseTypeReference`.
+ * Defaults to 256. Set to 0 to disable the limit.
+ *
* Those magic functions allow partial parsing:
*
* @method static NameNode name(Source|string $source, ParserOptions $options = [])
@@ -167,6 +173,9 @@ use Automattic\WooCommerce\Vendor\GraphQL\Language\AST\VariableNode;
*/
class Parser
{
+ /** @api */
+ public const DEFAULT_RECURSION_LIMIT = 256;
+
/**
* Given a Automattic\WooCommerce\Vendor\GraphQL source, parses it into a `Automattic\WooCommerce\Vendor\GraphQL\Language\AST\DocumentNode`.
*
@@ -317,6 +326,10 @@ class Parser
private Lexer $lexer;
+ private int $recursionDepth = 0;
+
+ private int $recursionLimit;
+
/**
* @param Source|string $source
*
@@ -328,6 +341,7 @@ class Parser
? $source
: new Source($source);
$this->lexer = new Lexer($sourceObj, $options);
+ $this->recursionLimit = $options['recursionLimit'] ?? self::DEFAULT_RECURSION_LIMIT;
}
/**
@@ -343,6 +357,16 @@ class Parser
return null;
}
+ /** @throws SyntaxError */
+ private function increaseRecursionDepth(): void
+ {
+ if ($this->recursionLimit > 0 && $this->recursionDepth >= $this->recursionLimit) {
+ throw new SyntaxError($this->lexer->source, $this->lexer->token->start, "Recursion depth limit of {$this->recursionLimit} exceeded");
+ }
+
+ ++$this->recursionDepth;
+ }
+
/** Determines if the next token is of a given kind. */
private function peek(string $kind): bool
{
@@ -701,18 +725,24 @@ class Parser
*/
private function parseSelectionSet(): SelectionSetNode
{
- $start = $this->lexer->token;
+ $this->increaseRecursionDepth();
- return new SelectionSetNode(
- [
- 'selections' => $this->many(
- Token::BRACE_L,
- fn (): SelectionNode => $this->parseSelection(),
- Token::BRACE_R
- ),
- 'loc' => $this->loc($start),
- ]
- );
+ try {
+ $start = $this->lexer->token;
+
+ return new SelectionSetNode(
+ [
+ 'selections' => $this->many(
+ Token::BRACE_L,
+ fn (): SelectionNode => $this->parseSelection(),
+ Token::BRACE_R
+ ),
+ 'loc' => $this->loc($start),
+ ]
+ );
+ } finally {
+ --$this->recursionDepth;
+ }
}
/**
@@ -911,67 +941,73 @@ class Parser
*/
private function parseValueLiteral(bool $isConst): ValueNode
{
- $token = $this->lexer->token;
- switch ($token->kind) {
- case Token::BRACKET_L:
- return $this->parseArray($isConst);
-
- case Token::BRACE_L:
- return $this->parseObject($isConst);
+ $this->increaseRecursionDepth();
- case Token::INT:
- $this->lexer->advance();
+ try {
+ $token = $this->lexer->token;
+ switch ($token->kind) {
+ case Token::BRACKET_L:
+ return $this->parseArray($isConst);
- return new IntValueNode([
- 'value' => $token->value,
- 'loc' => $this->loc($token),
- ]);
-
- case Token::FLOAT:
- $this->lexer->advance();
+ case Token::BRACE_L:
+ return $this->parseObject($isConst);
- return new FloatValueNode([
- 'value' => $token->value,
- 'loc' => $this->loc($token),
- ]);
+ case Token::INT:
+ $this->lexer->advance();
- case Token::STRING:
- case Token::BLOCK_STRING:
- return $this->parseStringLiteral();
+ return new IntValueNode([
+ 'value' => $token->value,
+ 'loc' => $this->loc($token),
+ ]);
- case Token::NAME:
- if ($token->value === 'true' || $token->value === 'false') {
+ case Token::FLOAT:
$this->lexer->advance();
- return new BooleanValueNode([
- 'value' => $token->value === 'true',
+ return new FloatValueNode([
+ 'value' => $token->value,
'loc' => $this->loc($token),
]);
- }
- if ($token->value === 'null') {
+ case Token::STRING:
+ case Token::BLOCK_STRING:
+ return $this->parseStringLiteral();
+
+ case Token::NAME:
+ if ($token->value === 'true' || $token->value === 'false') {
+ $this->lexer->advance();
+
+ return new BooleanValueNode([
+ 'value' => $token->value === 'true',
+ 'loc' => $this->loc($token),
+ ]);
+ }
+
+ if ($token->value === 'null') {
+ $this->lexer->advance();
+
+ return new NullValueNode([
+ 'loc' => $this->loc($token),
+ ]);
+ }
$this->lexer->advance();
- return new NullValueNode([
+ return new EnumValueNode([
+ 'value' => $token->value,
'loc' => $this->loc($token),
]);
- }
- $this->lexer->advance();
- return new EnumValueNode([
- 'value' => $token->value,
- 'loc' => $this->loc($token),
- ]);
+ case Token::DOLLAR:
+ if (! $isConst) {
+ return $this->parseVariable();
+ }
- case Token::DOLLAR:
- if (! $isConst) {
- return $this->parseVariable();
- }
+ break;
+ }
- break;
+ throw $this->unexpected();
+ } finally {
+ --$this->recursionDepth;
}
-
- throw $this->unexpected();
}
/**
@@ -1108,27 +1144,33 @@ class Parser
*/
private function parseTypeReference(): TypeNode
{
- $start = $this->lexer->token;
+ $this->increaseRecursionDepth();
- if ($this->skip(Token::BRACKET_L)) {
- $type = $this->parseTypeReference();
- $this->expect(Token::BRACKET_R);
- $type = new ListTypeNode([
- 'type' => $type,
- 'loc' => $this->loc($start),
- ]);
- } else {
- $type = $this->parseNamedType();
- }
+ try {
+ $start = $this->lexer->token;
- if ($this->skip(Token::BANG)) {
- return new NonNullTypeNode([
- 'type' => $type,
- 'loc' => $this->loc($start),
- ]);
- }
+ if ($this->skip(Token::BRACKET_L)) {
+ $type = $this->parseTypeReference();
+ $this->expect(Token::BRACKET_R);
+ $type = new ListTypeNode([
+ 'type' => $type,
+ 'loc' => $this->loc($start),
+ ]);
+ } else {
+ $type = $this->parseNamedType();
+ }
- return $type;
+ if ($this->skip(Token::BANG)) {
+ return new NonNullTypeNode([
+ 'type' => $type,
+ 'loc' => $this->loc($start),
+ ]);
+ }
+
+ return $type;
+ } finally {
+ --$this->recursionDepth;
+ }
}
/**
diff --git a/plugins/woocommerce/lib/packages/GraphQL/Validator/Rules/OverlappingFieldsCanBeMerged.php b/plugins/woocommerce/lib/packages/GraphQL/Validator/Rules/OverlappingFieldsCanBeMerged.php
index e72c899a568..163cadc23a1 100644
--- a/plugins/woocommerce/lib/packages/GraphQL/Validator/Rules/OverlappingFieldsCanBeMerged.php
+++ b/plugins/woocommerce/lib/packages/GraphQL/Validator/Rules/OverlappingFieldsCanBeMerged.php
@@ -33,6 +33,8 @@ use Automattic\WooCommerce\Vendor\GraphQL\Validator\QueryValidationContext;
*/
class OverlappingFieldsCanBeMerged extends ValidationRule
{
+ public const DEFAULT_MAX_COMPARISON_COUNT = 100_000;
+
/**
* A memoization for when two fragments are compared "between" each other for
* conflicts. Two fragments may be compared many times, so memoizing this can
@@ -49,10 +51,20 @@ class OverlappingFieldsCanBeMerged extends ValidationRule
*/
protected \SplObjectStorage $cachedFieldsAndFragmentNames;
+ protected int $comparisonCount;
+
+ protected int $comparisonLimit;
+
+ public function __construct(int $comparisonLimit = self::DEFAULT_MAX_COMPARISON_COUNT)
+ {
+ $this->comparisonLimit = $comparisonLimit;
+ }
+
public function getVisitor(QueryValidationContext $context): array
{
$this->comparedFragmentPairs = new PairSet();
$this->cachedFieldsAndFragmentNames = new \SplObjectStorage();
+ $this->comparisonCount = 0;
return [
NodeKind::SELECTION_SET => function (SelectionSetNode $selectionSet) use ($context): void {
@@ -399,6 +411,14 @@ class OverlappingFieldsCanBeMerged extends ValidationRule
array $field1,
array $field2
): ?array {
+ if (++$this->comparisonCount > $this->comparisonLimit) {
+ return [
+ [$responseName, 'Too many field comparisons, query is too complex to validate'],
+ [$field1[1]],
+ [$field2[1]],
+ ];
+ }
+
[$parentType1, $ast1, $def1] = $field1;
[$parentType2, $ast2, $def2] = $field2;